Update to Chromium version 68.0.3440.106

CHROMIUM_BUILD_COMPATIBILITY.txt

@@ -7,5 +7,5 @@
 # https://bitbucket.org/chromiumembedded/cef/wiki/BranchesAndBuilding
 
 {
-  'chromium_checkout': 'refs/tags/68.0.3440.0',
+  'chromium_checkout': 'refs/tags/68.0.3440.106',
 }

cmake/cef_variables.cmake.in

@@ -86,7 +86,8 @@ if(OS_LINUX)
     -Werror                         # Treat warnings as errors
     -Wno-missing-field-initializers # Don't warn about missing field initializers
     -Wno-unused-parameter           # Don't warn about unused parameters
-    -Wno-error=comment              # Don't complain about code in ascii art
+    -Wno-error=comment              # Don't warn about code in comments
+    -Wno-comment                    # Don't warn about code in comments
     )
   list(APPEND CEF_C_COMPILER_FLAGS
     -std=c99                        # Use the C99 language standard
@@ -336,12 +337,15 @@ if(OS_WINDOWS)
   option(USE_SANDBOX "Enable or disable use of the sandbox." ON)
   if(USE_SANDBOX)
     # Check if the current MSVC version is compatible with the cef_sandbox.lib
-    # static library.
+    # static library. For a list of all version numbers see
+    # https://en.wikipedia.org/wiki/Microsoft_Visual_C%2B%2B#Internal_version_numbering
     list(APPEND supported_msvc_versions
       1900  # VS2015 and updates 1, 2, & 3
       1910  # VS2017 version 15.1 & 15.2
       1911  # VS2017 version 15.3 & 15.4
       1912  # VS2017 version 15.5
+      1913  # VS2017 version 15.6
+      1914  # VS2017 version 15.7
       )
     list(FIND supported_msvc_versions ${MSVC_VERSION} _index)
     if (${_index} EQUAL -1)

include/internal/cef_types.h

@@ -151,14 +151,6 @@ typedef struct _cef_settings_t {
   ///
   size_t size;
 
-  ///
-  // Set to true (1) to use a single process for the browser and renderer. This
-  // run mode is not officially supported by Chromium and is less stable than
-  // the multi-process default. Also configurable using the "single-process"
-  // command-line switch.
-  ///
-  int single_process;
-
   ///
   // Set to true (1) to disable the sandbox for sub-processes. See
   // cef_sandbox_win.h for requirements to enable the sandbox on Windows. Also

include/internal/cef_types_wrappers.h

@@ -539,7 +539,6 @@ struct CefSettingsTraits {
   static inline void set(const struct_type* src,
                          struct_type* target,
                          bool copy) {
-    target->single_process = src->single_process;
     target->no_sandbox = src->no_sandbox;
     cef_string_set(src->browser_subprocess_path.str,
                    src->browser_subprocess_path.length,

libcef/browser/browser_message_loop.cc

@@ -7,7 +7,6 @@
 #include "libcef/common/content_client.h"
 
 #include "base/memory/ptr_util.h"
-#include "base/run_loop.h"
 
 #if defined(OS_MACOSX)
 #include "base/mac/scoped_nsautorelease_pool.h"
@@ -103,20 +102,3 @@ CefBrowserMessageLoop::CefBrowserMessageLoop()
 }
 
 CefBrowserMessageLoop::~CefBrowserMessageLoop() {}
-
-// static
-CefBrowserMessageLoop* CefBrowserMessageLoop::current() {
-  base::MessageLoop* loop = base::MessageLoop::current();
-  DCHECK(loop->IsType(base::MessageLoop::TYPE_UI));
-  return static_cast<CefBrowserMessageLoop*>(loop);
-}
-
-void CefBrowserMessageLoop::DoMessageLoopIteration() {
-  base::RunLoop run_loop;
-  run_loop.RunUntilIdle();
-}
-
-void CefBrowserMessageLoop::RunMessageLoop() {
-  base::RunLoop run_loop;
-  run_loop.Run();
-}

libcef/browser/browser_message_loop.h

@@ -17,15 +17,6 @@ class CefBrowserMessageLoop : public base::MessageLoopForUI {
   CefBrowserMessageLoop();
   ~CefBrowserMessageLoop() override;
 
-  // Returns the CefBrowserMessageLoop of the current thread.
-  static CefBrowserMessageLoop* current();
-
-  // Do a single interation of the UI message loop.
-  void DoMessageLoopIteration();
-
-  // Run the UI message loop.
-  void RunMessageLoop();
-
  private:
   DISALLOW_COPY_AND_ASSIGN(CefBrowserMessageLoop);
 };

libcef/browser/content_browser_client.cc

@@ -41,6 +41,7 @@
 #include "base/json/json_reader.h"
 #include "base/path_service.h"
 #include "cef/grit/cef_resources.h"
+#include "chrome/browser/browser_process.h"
 #include "chrome/browser/chrome_service.h"
 #include "chrome/browser/plugins/plugin_info_host_impl.h"
 #include "chrome/browser/profiles/profile.h"
@@ -765,6 +766,10 @@ void CefContentBrowserClient::AppendExtraCommandLineSwitches(
   }
 }
 
+std::string CefContentBrowserClient::GetApplicationLocale() {
+  return g_browser_process->GetApplicationLocale();
+}
+
 content::QuotaPermissionContext*
 CefContentBrowserClient::CreateQuotaPermissionContext() {
   return new CefQuotaPermissionContext();

libcef/browser/content_browser_client.h

@@ -62,6 +62,7 @@ class CefContentBrowserClient : public content::ContentBrowserClient {
                             content::BrowserContext* context2) override;
   void AppendExtraCommandLineSwitches(base::CommandLine* command_line,
                                       int child_process_id) override;
+  std::string GetApplicationLocale() override;
   content::QuotaPermissionContext* CreateQuotaPermissionContext() override;
   void GetQuotaSettings(
       content::BrowserContext* context,

libcef/browser/context.cc

@@ -7,7 +7,6 @@
 #include "libcef/browser/browser_info.h"
 #include "libcef/browser/browser_info_manager.h"
 #include "libcef/browser/browser_main.h"
-#include "libcef/browser/browser_message_loop.h"
 #include "libcef/browser/chrome_browser_process_stub.h"
 #include "libcef/browser/thread_util.h"
 #include "libcef/browser/trace_subscriber.h"
@@ -21,6 +20,7 @@
 #include "base/command_line.h"
 #include "base/debug/debugger.h"
 #include "base/files/file_util.h"
+#include "base/run_loop.h"
 #include "base/synchronization/waitable_event.h"
 #include "components/network_session_configurator/common/network_switches.h"
 #include "content/app/content_service_manager_main_delegate.h"
@@ -271,7 +271,8 @@ void CefDoMessageLoopWork() {
     return;
   }
 
-  CefBrowserMessageLoop::current()->DoMessageLoopIteration();
+  base::RunLoop run_loop;
+  run_loop.RunUntilIdle();
 }
 
 void CefRunMessageLoop() {
@@ -287,7 +288,8 @@ void CefRunMessageLoop() {
     return;
   }
 
-  CefBrowserMessageLoop::current()->RunMessageLoop();
+  base::RunLoop run_loop;
+  run_loop.Run();
 }
 
 void CefQuitMessageLoop() {

libcef/browser/devtools_frontend.cc

@@ -100,7 +100,7 @@ int ResponseWriter::Finish(int net_error,
 }
 
 static std::string GetFrontendURL() {
-  return base::StringPrintf("%s://%s/inspector.html",
+  return base::StringPrintf("%s://%s/devtools_app.html",
                             content::kChromeDevToolsScheme,
                             scheme::kChromeDevToolsHost);
 }

libcef/browser/osr/render_widget_host_view_osr.cc

@@ -734,9 +734,8 @@ void CefRenderWidgetHostViewOSR::GetScreenInfo(
   *results = ScreenInfoFrom(screen_info);
 }
 
-gfx::Vector2d CefRenderWidgetHostViewOSR::GetOffsetFromRootSurface() {
-  return gfx::Vector2d();
-}
+void CefRenderWidgetHostViewOSR::TransformPointToRootSurface(
+    gfx::PointF* point) {}
 
 gfx::Rect CefRenderWidgetHostViewOSR::GetBoundsInRootWindow() {
   if (!browser_impl_.get())

libcef/browser/osr/render_widget_host_view_osr.h

@@ -154,7 +154,7 @@ class CefRenderWidgetHostViewOSR : public content::RenderWidgetHostViewBase,
       const gfx::Size& output_size,
       base::OnceCallback<void(const SkBitmap&)> callback) override;
   void GetScreenInfo(content::ScreenInfo* results) const override;
-  gfx::Vector2d GetOffsetFromRootSurface() override;
+  void TransformPointToRootSurface(gfx::PointF* point) override;
   gfx::Rect GetBoundsInRootWindow() override;
   viz::SurfaceId GetCurrentSurfaceId() const override;
   content::BrowserAccessibilityManager* CreateBrowserAccessibilityManager(

libcef/common/content_client.cc

@@ -52,7 +52,7 @@ const char kPDFPluginExtension[] = "pdf";
 const char kPDFPluginDescription[] = "Portable Document Format";
 const char kPDFPluginOutOfProcessMimeType[] = "application/x-google-chrome-pdf";
 const uint32_t kPDFPluginPermissions =
-    ppapi::PERMISSION_PRIVATE | ppapi::PERMISSION_DEV;
+    ppapi::PERMISSION_PDF | ppapi::PERMISSION_DEV;
 
 content::PepperPluginInfo::GetInterfaceFunc g_pdf_get_interface;
 content::PepperPluginInfo::PPP_InitializeModuleFunc g_pdf_initialize_module;

libcef/common/main_delegate.cc

@@ -28,6 +28,7 @@
 #include "chrome/common/chrome_switches.h"
 #include "components/content_settings/core/common/content_settings_pattern.h"
 #include "components/viz/common/features.h"
+#include "content/browser/browser_process_sub_thread.h"
 #include "content/public/browser/browser_main_runner.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/common/content_features.h"
@@ -243,9 +244,12 @@ bool IsScaleFactorSupported(ui::ScaleFactor scale_factor) {
 // Used to run the UI on a separate thread.
 class CefUIThread : public base::Thread {
  public:
-  explicit CefUIThread(const content::MainFunctionParams& main_function_params)
+  CefUIThread(
+      const content::MainFunctionParams& main_function_params,
+      std::unique_ptr<content::BrowserProcessSubThread> service_manager_thread)
       : base::Thread("CefUIThread"),
-        main_function_params_(main_function_params) {}
+        main_function_params_(main_function_params),
+        service_manager_thread_(std::move(service_manager_thread)) {}
 
   void Init() override {
 #if defined(OS_WIN)
@@ -257,7 +261,8 @@ class CefUIThread : public base::Thread {
     browser_runner_.reset(content::BrowserMainRunner::Create());
 
     // Initialize browser process state. Uses the current thread's mesage loop.
-    int exit_code = browser_runner_->Initialize(main_function_params_);
+    int exit_code = browser_runner_->Initialize(
+        main_function_params_, std::move(service_manager_thread_));
     CHECK_EQ(exit_code, -1);
   }
 
@@ -274,6 +279,7 @@ class CefUIThread : public base::Thread {
 
  protected:
   content::MainFunctionParams main_function_params_;
+  std::unique_ptr<content::BrowserProcessSubThread> service_manager_thread_;
   std::unique_ptr<content::BrowserMainRunner> browser_runner_;
 };
 
@@ -314,9 +320,6 @@ bool CefMainDelegate::BasicStartupComplete(int* exit_code) {
       const_cast<base::CommandLine::SwitchMap*>(&map)->clear();
     }
 
-    if (settings.single_process)
-      command_line->AppendSwitch(switches::kSingleProcess);
-
     bool no_sandbox = settings.no_sandbox ? true : false;
 
     if (settings.browser_subprocess_path.length > 0) {
@@ -573,6 +576,13 @@ void CefMainDelegate::SandboxInitialized(const std::string& process_type) {
 int CefMainDelegate::RunProcess(
     const std::string& process_type,
     const content::MainFunctionParams& main_function_params) {
+  return RunProcess(process_type, main_function_params, nullptr);
+}
+
+int CefMainDelegate::RunProcess(
+    const std::string& process_type,
+    const content::MainFunctionParams& main_function_params,
+    std::unique_ptr<content::BrowserProcessSubThread> service_manager_thread) {
   if (process_type.empty()) {
     const CefSettings& settings = CefContext::Get()->settings();
     if (!settings.multi_threaded_message_loop) {
@@ -582,13 +592,15 @@ int CefMainDelegate::RunProcess(
       // Initialize browser process state. Results in a call to
       // CefBrowserMain::PreMainMessageLoopStart() which creates the UI message
       // loop.
-      int exit_code = browser_runner_->Initialize(main_function_params);
+      int exit_code = browser_runner_->Initialize(
+          main_function_params, std::move(service_manager_thread));
       if (exit_code >= 0)
         return exit_code;
     } else {
       // Run the UI on a separate thread.
       std::unique_ptr<base::Thread> thread;
-      thread.reset(new CefUIThread(main_function_params));
+      thread.reset(new CefUIThread(main_function_params,
+                                   std::move(service_manager_thread)));
       base::Thread::Options options;
       options.message_loop_type = base::MessageLoop::TYPE_UI;
       if (!thread->StartWithOptions(options)) {

libcef/common/main_delegate.h

@@ -38,6 +38,10 @@ class CefMainDelegate : public content::ContentMainDelegate {
   int RunProcess(
       const std::string& process_type,
       const content::MainFunctionParams& main_function_params) override;
+  int RunProcess(const std::string& process_type,
+                 const content::MainFunctionParams& main_function_params,
+                 std::unique_ptr<content::BrowserProcessSubThread>
+                     service_manager_thread) override;
   void ProcessExiting(const std::string& process_type) override;
 #if defined(OS_LINUX)
   void ZygoteForked() override;

libcef/renderer/browser_impl.cc

@@ -345,7 +345,7 @@ CefRefPtr<CefFrameImpl> CefBrowserImpl::GetWebFrameImpl(
   if (it != frames_.end())
     return it->second;
 
-  CefRefPtr<CefFrameImpl> framePtr(new CefFrameImpl(this, frame));
+  CefRefPtr<CefFrameImpl> framePtr(new CefFrameImpl(this, frame, frame_id));
   frames_.insert(std::make_pair(frame_id, framePtr));
 
   const int64_t parent_id = frame->Parent() == NULL

libcef/renderer/frame_impl.cc

@@ -27,6 +27,7 @@
 #include "third_party/blink/public/platform/web_url.h"
 #include "third_party/blink/public/web/blink.h"
 #include "third_party/blink/public/web/web_document.h"
+#include "third_party/blink/public/web/web_document_loader.h"
 #include "third_party/blink/public/web/web_frame_content_dumper.h"
 #include "third_party/blink/public/web/web_local_frame.h"
 #include "third_party/blink/public/web/web_script_source.h"
@@ -34,10 +35,10 @@
 
 using blink::WebString;
 
-CefFrameImpl::CefFrameImpl(CefBrowserImpl* browser, blink::WebLocalFrame* frame)
-    : browser_(browser),
-      frame_(frame),
-      frame_id_(render_frame_util::GetIdentifier(frame)) {}
+CefFrameImpl::CefFrameImpl(CefBrowserImpl* browser,
+                           blink::WebLocalFrame* frame,
+                           int64_t frame_id)
+    : browser_(browser), frame_(frame), frame_id_(frame_id) {}
 
 CefFrameImpl::~CefFrameImpl() {}
 
@@ -216,6 +217,13 @@ CefString CefFrameImpl::GetURL() {
 
   if (frame_) {
     GURL gurl = frame_->GetDocument().Url();
+    if (gurl.is_empty()) {
+      // For popups the main document URL will be empty during loading. Return
+      // the provisional document URL instead.
+      blink::WebDocumentLoader* loader = frame_->GetProvisionalDocumentLoader();
+      if (loader)
+        gurl = loader->GetRequest().Url();
+    }
     url = gurl.spec();
   }
   return url;

libcef/renderer/frame_impl.h

@@ -21,7 +21,9 @@ class WebLocalFrame;
 // associated renderer WebFrame will close.
 class CefFrameImpl : public CefFrame {
  public:
-  CefFrameImpl(CefBrowserImpl* browser, blink::WebLocalFrame* frame);
+  CefFrameImpl(CefBrowserImpl* browser,
+               blink::WebLocalFrame* frame,
+               int64_t frame_id);
   ~CefFrameImpl() override;
 
   // CefFrame implementation.

patch/patch.cfg

@@ -368,4 +368,19 @@ patches = [
     # https://bugs.chromium.org/p/chromium/issues/detail?id=729800#c48
     'name': 'net_cookies_729800',
   },
+  {
+    # Pass BrowserProcessSubThread to ContentMainDelegate::RunProcess.
+    # https://bitbucket.org/chromiumembedded/cef/issues/2456
+    'name': 'content_runprocess_2456',
+  },
+  {
+    # Linux: Use poll instead of select to fix crash during startup.
+    # https://bitbucket.org/chromiumembedded/cef/issues/2466
+    'name': 'linux_poll_2466',
+  },
+  {
+    # RTL document in <iframe> should have left-hand scrollbar.
+    # https://bugs.chromium.org/p/chromium/issues/detail?id=250514#c34
+    'name': 'webkit_rtl_scrollbars_250514',
+  },
 ]

patch/patches/browser_compositor_mac.patch

@@ -19,7 +19,7 @@ index bc9eba153a6a..f6d2856e8eab 100644
    void DidCreateNewRendererCompositorFrameSink(
        viz::mojom::CompositorFrameSinkClient* renderer_compositor_frame_sink);
 diff --git content/browser/renderer_host/browser_compositor_view_mac.mm content/browser/renderer_host/browser_compositor_view_mac.mm
-index bc1492dee443..7ebf4188f2c8 100644
+index 3d12a1126a0d..7a60368b2c8a 100644
 --- content/browser/renderer_host/browser_compositor_view_mac.mm
 +++ content/browser/renderer_host/browser_compositor_view_mac.mm
 @@ -240,6 +240,12 @@ BrowserCompositorMac::~BrowserCompositorMac() {

patch/patches/browser_plugin_guest_1565.patch

@@ -37,10 +37,10 @@ index a0bc9305e62d..0c8d42c55302 100644
  
    attached_ = true;
 diff --git content/browser/frame_host/interstitial_page_impl.cc content/browser/frame_host/interstitial_page_impl.cc
-index 7c55f52cb49a..fa1c85a86ed5 100644
+index ad9de41d1e3e..a87ec19a5f54 100644
 --- content/browser/frame_host/interstitial_page_impl.cc
 +++ content/browser/frame_host/interstitial_page_impl.cc
-@@ -619,7 +619,7 @@ WebContentsView* InterstitialPageImpl::CreateWebContentsView() {
+@@ -622,7 +622,7 @@ WebContentsView* InterstitialPageImpl::CreateWebContentsView() {
    WebContentsView* wcv =
        static_cast<WebContentsImpl*>(web_contents())->GetView();
    RenderWidgetHostViewBase* view =
@@ -266,7 +266,7 @@ index d05dd5421458..fa13775f0512 100644
    // a BrowserPlugin even when we are using cross process frames for guests. It
    // should be removed after resolving https://crbug.com/642826).
 diff --git extensions/browser/guest_view/mime_handler_view/mime_handler_view_guest.cc extensions/browser/guest_view/mime_handler_view/mime_handler_view_guest.cc
-index 8aa4bd7ffca6..0a649863f381 100644
+index 07f7fb42f539..82a98fc9edd4 100644
 --- extensions/browser/guest_view/mime_handler_view/mime_handler_view_guest.cc
 +++ extensions/browser/guest_view/mime_handler_view/mime_handler_view_guest.cc
 @@ -193,6 +193,8 @@ void MimeHandlerViewGuest::CreateWebContents(
@@ -277,8 +277,8 @@ index 8aa4bd7ffca6..0a649863f381 100644
 +    delegate_->OverrideWebContentsCreateParams(&params);
    // TODO(erikchen): Fix ownership semantics for guest views.
    // https://crbug.com/832879.
-   callback.Run(WebContents::Create(params).release());
-@@ -228,6 +230,18 @@ bool MimeHandlerViewGuest::ShouldDestroyOnDetach() const {
+   callback.Run(
+@@ -232,6 +234,18 @@ bool MimeHandlerViewGuest::ShouldDestroyOnDetach() const {
    return true;
  }
  

patch/patches/chrome_browser.patch

@@ -1,5 +1,5 @@
 diff --git chrome/browser/BUILD.gn chrome/browser/BUILD.gn
-index b8a22d99f3cf..da1d8cfcf86a 100644
+index 054c6e2a5262..9808f2bc45c0 100644
 --- chrome/browser/BUILD.gn
 +++ chrome/browser/BUILD.gn
 @@ -8,6 +8,7 @@ import("//build/config/features.gni")
@@ -10,7 +10,7 @@ index b8a22d99f3cf..da1d8cfcf86a 100644
  import("//chrome/common/features.gni")
  import("//components/feature_engagement/features.gni")
  import("//components/feed/features.gni")
-@@ -1594,6 +1595,7 @@ jumbo_split_static_library("browser") {
+@@ -1612,6 +1613,7 @@ jumbo_split_static_library("browser") {
      "//base:i18n",
      "//base/allocator:buildflags",
      "//cc",
@@ -18,7 +18,7 @@ index b8a22d99f3cf..da1d8cfcf86a 100644
      "//chrome:extra_resources",
      "//chrome:resources",
      "//chrome:strings",
-@@ -1860,6 +1862,10 @@ jumbo_split_static_library("browser") {
+@@ -1878,6 +1880,10 @@ jumbo_split_static_library("browser") {
      ]
    }
  

patch/patches/chrome_browser_profiles.patch

@@ -70,10 +70,10 @@ index e8e76ce5b954..1dd338dd0142 100644
  content::BrowserContext* GetBrowserContextRedirectedInIncognito(
      content::BrowserContext* context);
 diff --git chrome/browser/profiles/profile_manager.cc chrome/browser/profiles/profile_manager.cc
-index fc316ed90cfd..eef294ac6985 100644
+index 359f6f767bf8..9d3ff4cd0845 100644
 --- chrome/browser/profiles/profile_manager.cc
 +++ chrome/browser/profiles/profile_manager.cc
-@@ -379,7 +379,7 @@ ProfileManager::ProfileManager(const base::FilePath& user_data_dir)
+@@ -382,7 +382,7 @@ ProfileManager::ProfileManager(const base::FilePath& user_data_dir)
        chrome::NOTIFICATION_BROWSER_CLOSE_CANCELLED,
        content::NotificationService::AllSources());
  

patch/patches/content_2015.patch

@@ -94,10 +94,10 @@ index b23698013a09..d60eb48c6efd 100644
                  "WillFailRequest state should come before WillProcessResponse");
    return render_frame_host_;
 diff --git content/browser/frame_host/render_frame_host_impl.cc content/browser/frame_host/render_frame_host_impl.cc
-index 2ef1f5b667fa..c0296f748648 100644
+index cd755cbc3f2c..23d1aad71b6e 100644
 --- content/browser/frame_host/render_frame_host_impl.cc
 +++ content/browser/frame_host/render_frame_host_impl.cc
-@@ -1568,6 +1568,7 @@ void RenderFrameHostImpl::OnDidFailProvisionalLoadWithError(
+@@ -1602,6 +1602,7 @@ void RenderFrameHostImpl::OnDidFailProvisionalLoadWithError(
    if (GetNavigationHandle()) {
      GetNavigationHandle()->set_net_error_code(
          static_cast<net::Error>(params.error_code));
@@ -105,7 +105,7 @@ index 2ef1f5b667fa..c0296f748648 100644
    }
  
    frame_tree_node_->navigator()->DidFailProvisionalLoadWithError(this, params);
-@@ -3328,9 +3329,9 @@ void RenderFrameHostImpl::RegisterMojoInterfaces() {
+@@ -3476,9 +3477,9 @@ void RenderFrameHostImpl::RegisterMojoInterfaces() {
        BrowserThread::GetTaskRunnerForThread(BrowserThread::IO));
  
    if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
@@ -118,7 +118,7 @@ index 2ef1f5b667fa..c0296f748648 100644
      // TODO(https://crbug.com/813479): Investigate why we need to explicitly
      // specify task runner for BrowserThread::IO here.
      // Bind calls to the BindRegistry should come on to the IO thread by
-@@ -3606,9 +3607,9 @@ void RenderFrameHostImpl::CommitNavigation(
+@@ -3880,9 +3881,9 @@ void RenderFrameHostImpl::CommitNavigation(
      // however only do this for cross-document navigations, because the
      // alternative would be redundant effort.
      network::mojom::URLLoaderFactoryPtrInfo default_factory_info;
@@ -131,7 +131,7 @@ index 2ef1f5b667fa..c0296f748648 100644
      if (subresource_loader_params &&
          subresource_loader_params->loader_factory_info.is_valid()) {
        // If the caller has supplied a default URLLoaderFactory override (for
-@@ -4300,8 +4301,8 @@ void RenderFrameHostImpl::CreateNetworkServiceDefaultFactoryAndObserve(
+@@ -4574,8 +4575,8 @@ void RenderFrameHostImpl::CreateNetworkServiceDefaultFactoryAndObserve(
    RenderFrameDevToolsAgentHost::WillCreateURLLoaderFactory(
        this, false /* is_navigation */, false /* is_download */,
        &default_factory_request);
@@ -275,10 +275,10 @@ index 4e11056a3dc9..973ad50975e1 100644
                       const std::string& mime_type,
                       bool allow_wildcard,
 diff --git content/common/frame_messages.h content/common/frame_messages.h
-index 3ed93bdae0e3..c03780d69cfb 100644
+index 98bc62f6c937..d235b67810dd 100644
 --- content/common/frame_messages.h
 +++ content/common/frame_messages.h
-@@ -1363,8 +1363,9 @@ IPC_MESSAGE_ROUTED1(FrameHostMsg_PepperStopsPlayback,
+@@ -1376,8 +1376,9 @@ IPC_MESSAGE_ROUTED1(FrameHostMsg_PepperStopsPlayback,
  
  // Used to get the list of plugins. |main_frame_origin| is used to handle
  // exceptions for plugin content settings.
@@ -289,7 +289,7 @@ index 3ed93bdae0e3..c03780d69cfb 100644
                              url::Origin /* main_frame_origin */,
                              std::vector<content::WebPluginInfo> /* plugins */)
  
-@@ -1372,9 +1373,10 @@ IPC_SYNC_MESSAGE_CONTROL2_1(FrameHostMsg_GetPlugins,
+@@ -1385,9 +1386,10 @@ IPC_SYNC_MESSAGE_CONTROL2_1(FrameHostMsg_GetPlugins,
  // type. If there is no matching plugin, |found| is false.
  // |actual_mime_type| is the actual mime type supported by the
  // found plugin.
@@ -389,10 +389,10 @@ index 74a031ad10c3..3b3f9e292f4b 100644
    virtual void FocusedNodeChanged(const blink::WebNode& node) {}
  
 diff --git content/renderer/render_frame_impl.cc content/renderer/render_frame_impl.cc
-index fd8ec4750c17..714c46e6f3ed 100644
+index c027c4df3423..a2f9ef9de0a3 100644
 --- content/renderer/render_frame_impl.cc
 +++ content/renderer/render_frame_impl.cc
-@@ -3253,7 +3253,8 @@ blink::WebPlugin* RenderFrameImpl::CreatePlugin(
+@@ -3256,7 +3256,8 @@ blink::WebPlugin* RenderFrameImpl::CreatePlugin(
    std::string mime_type;
    bool found = false;
    Send(new FrameHostMsg_GetPluginInfo(
@@ -402,7 +402,7 @@ index fd8ec4750c17..714c46e6f3ed 100644
        params.mime_type.Utf8(), &found, &info, &mime_type));
    if (!found)
      return nullptr;
-@@ -3610,6 +3611,8 @@ void RenderFrameImpl::FrameDetached(DetachType type) {
+@@ -3613,6 +3614,8 @@ void RenderFrameImpl::FrameDetached(DetachType type) {
  
  void RenderFrameImpl::FrameFocused() {
    Send(new FrameHostMsg_FrameFocused(routing_id_));
@@ -412,7 +412,7 @@ index fd8ec4750c17..714c46e6f3ed 100644
  
  void RenderFrameImpl::WillCommitProvisionalLoad() {
 diff --git content/renderer/render_thread_impl.cc content/renderer/render_thread_impl.cc
-index 1e68c2fee634..75d5dfade01f 100644
+index 06f7d4487997..5c2519ebf2f1 100644
 --- content/renderer/render_thread_impl.cc
 +++ content/renderer/render_thread_impl.cc
 @@ -876,6 +876,8 @@ void RenderThreadImpl::Init(

patch/patches/content_runprocess_2456.patch

@@ -0,0 +1,102 @@
+diff --git content/app/content_main_runner_impl.cc content/app/content_main_runner_impl.cc
+index 83e8990edf17..89bdab3f3885 100644
+--- content/app/content_main_runner_impl.cc
++++ content/app/content_main_runner_impl.cc
+@@ -603,7 +603,8 @@ int RunBrowserProcessMain(
+     ContentMainDelegate* delegate,
+     std::unique_ptr<BrowserProcessSubThread> service_manager_thread) {
+   if (delegate) {
+-    int exit_code = delegate->RunProcess("", main_function_params);
++    int exit_code = delegate->RunProcess("", main_function_params,
++                                         std::move(service_manager_thread));
+ #if defined(OS_ANDROID)
+     // In Android's browser process, the negative exit code doesn't mean the
+     // default behavior should be used as the UI message loop is managed by
+diff --git content/browser/browser_main_runner_impl.h content/browser/browser_main_runner_impl.h
+index adb084fe27c6..42a6fdc2d67f 100644
+--- content/browser/browser_main_runner_impl.h
++++ content/browser/browser_main_runner_impl.h
+@@ -42,7 +42,7 @@ class BrowserMainRunnerImpl : public BrowserMainRunner {
+   // on which ServiceManager is currently running.
+   int Initialize(
+       const MainFunctionParams& parameters,
+-      std::unique_ptr<BrowserProcessSubThread> service_manager_thread);
++      std::unique_ptr<BrowserProcessSubThread> service_manager_thread) override;
+ 
+  private:
+   // True if we have started to initialize the runner.
+diff --git content/public/app/content_main_delegate.cc content/public/app/content_main_delegate.cc
+index c4bdfd36ad0c..f6830c35fd1d 100644
+--- content/public/app/content_main_delegate.cc
++++ content/public/app/content_main_delegate.cc
+@@ -6,6 +6,7 @@
+ 
+ #include "base/logging.h"
+ #include "build/build_config.h"
++#include "content/browser/browser_process_sub_thread.h"
+ #include "content/public/gpu/content_gpu_client.h"
+ #include "content/public/renderer/content_renderer_client.h"
+ #include "content/public/utility/content_utility_client.h"
+@@ -26,6 +27,13 @@ int ContentMainDelegate::RunProcess(
+   return -1;
+ }
+ 
++int ContentMainDelegate::RunProcess(
++    const std::string& process_type,
++    const MainFunctionParams& main_function_params,
++    std::unique_ptr<BrowserProcessSubThread> service_manager_thread) {
++  return RunProcess(process_type, main_function_params);
++}
++
+ ui::DataPack* ContentMainDelegate::LoadServiceManifestDataPack() {
+   return nullptr;
+ }
+diff --git content/public/app/content_main_delegate.h content/public/app/content_main_delegate.h
+index b5d8b1889d60..ea6af1600c36 100644
+--- content/public/app/content_main_delegate.h
++++ content/public/app/content_main_delegate.h
+@@ -30,6 +30,7 @@ class DataPack;
+ 
+ namespace content {
+ 
++class BrowserProcessSubThread;
+ class ContentBrowserClient;
+ class ContentGpuClient;
+ class ContentRendererClient;
+@@ -60,6 +61,12 @@ class CONTENT_EXPORT ContentMainDelegate {
+       const std::string& process_type,
+       const MainFunctionParams& main_function_params);
+ 
++  // Asks the embedder to start a process. Return -1 for the default behavior.
++  virtual int RunProcess(
++      const std::string& process_type,
++      const MainFunctionParams& main_function_params,
++      std::unique_ptr<BrowserProcessSubThread> service_manager_thread);
++
+   // Called right before the process exits.
+   virtual void ProcessExiting(const std::string& process_type) {}
+ 
+diff --git content/public/browser/browser_main_runner.h content/public/browser/browser_main_runner.h
+index c01be956eded..8cbd8d894ac5 100644
+--- content/public/browser/browser_main_runner.h
++++ content/public/browser/browser_main_runner.h
+@@ -10,6 +10,7 @@
+ 
+ namespace content {
+ 
++class BrowserProcessSubThread;
+ struct MainFunctionParams;
+ 
+ // This class is responsible for browser initialization, running and shutdown.
+@@ -26,7 +27,10 @@ class CONTENT_EXPORT BrowserMainRunner {
+   // Initialize all necessary browser state. The |parameters| values will be
+   // copied. Returning a non-negative value indicates that initialization
+   // failed, and the returned value is used as the exit code for the process.
+-  virtual int Initialize(const content::MainFunctionParams& parameters) = 0;
++  virtual int Initialize(const MainFunctionParams& parameters) = 0;
++  virtual int Initialize(
++      const MainFunctionParams& parameters,
++      std::unique_ptr<BrowserProcessSubThread> service_manager_thread) = 0;
+ 
+ #if defined(OS_ANDROID)
+   // Run all queued startup tasks. Only defined on Android because other

patch/patches/extensions_1947.patch

@@ -27,10 +27,10 @@ index 53c7404ef1f9..ac33df7cfe0e 100644
    auto* browser_context = web_contents->GetBrowserContext();
    StreamsPrivateAPI* streams_private = GetStreamsPrivateAPI(browser_context);
 diff --git content/browser/frame_host/render_frame_host_manager.cc content/browser/frame_host/render_frame_host_manager.cc
-index 7f6e27181267..26080b6d61e0 100644
+index b682235b0f87..50fff0f5e26b 100644
 --- content/browser/frame_host/render_frame_host_manager.cc
 +++ content/browser/frame_host/render_frame_host_manager.cc
-@@ -897,10 +897,11 @@ bool RenderFrameHostManager::ShouldSwapBrowsingInstancesForNavigation(
+@@ -906,10 +906,11 @@ bool RenderFrameHostManager::ShouldSwapBrowsingInstancesForNavigation(
    // TODO(alexmos): This check should've been enforced earlier in the
    // navigation, in chrome::Navigate().  Verify this, and then convert this to
    // a CHECK and remove the fallback.
@@ -46,7 +46,7 @@ index 7f6e27181267..26080b6d61e0 100644
      return true;
    }
  
-@@ -1041,7 +1042,8 @@ RenderFrameHostManager::GetSiteInstanceForNavigation(
+@@ -1050,7 +1051,8 @@ RenderFrameHostManager::GetSiteInstanceForNavigation(
  
    // Double-check that the new SiteInstance is associated with the right
    // BrowserContext.

patch/patches/gn_config.patch

@@ -56,7 +56,7 @@ index 982fbe8d3f0d..e757be4688f1 100644
 +         "studio path")
  }
 diff --git build/toolchain/win/BUILD.gn build/toolchain/win/BUILD.gn
-index 4d9d1f45f870..c668f93a50f3 100644
+index 4d9d1f45f870..7a601e634a69 100644
 --- build/toolchain/win/BUILD.gn
 +++ build/toolchain/win/BUILD.gn
 @@ -6,6 +6,7 @@ import("//build/config/clang/clang.gni")
@@ -76,6 +76,15 @@ index 4d9d1f45f870..c668f93a50f3 100644
  } else {
    goma_prefix = ""
  }
+@@ -108,7 +111,7 @@ template("msvc_toolchain") {
+ 
+       # lld-link includes a replacement for lib.exe that can produce thin
+       # archives and understands bitcode (for lto builds).
+-      lib = "$prefix/$lld_link /lib /llvmlibthin"
++      lib = "$prefix/$lld_link /lib"
+       link = "$prefix/$lld_link"
+       if (host_os != "win") {
+         # See comment adding --rsp-quoting to $cl above for more information.
 diff --git build/toolchain/win/setup_toolchain.py build/toolchain/win/setup_toolchain.py
 index d63b131aea35..6aca4e2cc56e 100644
 --- build/toolchain/win/setup_toolchain.py

patch/patches/linux_poll_2466.patch

@@ -0,0 +1,48 @@
+diff --git base/files/file_path_watcher_linux.cc base/files/file_path_watcher_linux.cc
+index c58d6865c27b..6ab39432259d 100644
+--- base/files/file_path_watcher_linux.cc
++++ base/files/file_path_watcher_linux.cc
+@@ -5,6 +5,7 @@
+ #include "base/files/file_path_watcher.h"
+ 
+ #include <errno.h>
++#include <poll.h>
+ #include <stddef.h>
+ #include <string.h>
+ #include <sys/inotify.h>
+@@ -13,6 +14,7 @@
+ #include <unistd.h>
+ 
+ #include <algorithm>
++#include <array>
+ #include <map>
+ #include <memory>
+ #include <set>
+@@ -221,20 +223,15 @@ LazyInstance<InotifyReader>::Leaky g_inotify_reader = LAZY_INSTANCE_INITIALIZER;
+ void InotifyReaderThreadDelegate::ThreadMain() {
+   PlatformThread::SetName("inotify_reader");
+ 
+-  // Make sure the file descriptors are good for use with select().
+-  CHECK_LE(0, inotify_fd_);
+-  CHECK_GT(FD_SETSIZE, inotify_fd_);
++  std::array<pollfd, 1> fdarray
++  { {
++      { inotify_fd_, POLLIN, 0 }
++  } };
+ 
+   while (true) {
+-    fd_set rfds;
+-    FD_ZERO(&rfds);
+-    FD_SET(inotify_fd_, &rfds);
+-
+-    // Wait until some inotify events are available.
+-    int select_result =
+-        HANDLE_EINTR(select(inotify_fd_ + 1, &rfds, nullptr, nullptr, nullptr));
+-    if (select_result < 0) {
+-      DPLOG(WARNING) << "select failed";
++    int poll_result = HANDLE_EINTR(poll(fdarray.data(), fdarray.size(), -1));
++    if (poll_result < 0) {
++      DPLOG(WARNING) << "poll failed";
+       return;
+     }
+ 

patch/patches/message_loop_443_1992243003.patch

@@ -34,7 +34,7 @@ index c5016dcf20a2..cf1db622f8fb 100644
  
  #if !defined(OS_NACL)
 diff --git base/message_loop/message_pump_win.cc base/message_loop/message_pump_win.cc
-index 8e6f1f41def2..b07865ebae37 100644
+index 68bb4c084653..d3995c4c403e 100644
 --- base/message_loop/message_pump_win.cc
 +++ base/message_loop/message_pump_win.cc
 @@ -11,6 +11,7 @@
@@ -45,7 +45,7 @@ index 8e6f1f41def2..b07865ebae37 100644
  #include "base/metrics/histogram_macros.h"
  #include "base/strings/stringprintf.h"
  #include "base/trace_event/trace_event.h"
-@@ -369,20 +370,28 @@ bool MessagePumpForUI::ProcessMessageHelper(const MSG& msg) {
+@@ -381,20 +382,28 @@ bool MessagePumpForUI::ProcessMessageHelper(const MSG& msg) {
  }
  
  bool MessagePumpForUI::ProcessPumpReplacementMessage() {

patch/patches/print_header_footer_1478_1565.patch

@@ -1,5 +1,5 @@
 diff --git chrome/browser/ui/BUILD.gn chrome/browser/ui/BUILD.gn
-index 3b9eb8dc8ca7..c37db3071302 100644
+index c514878fafe7..32e4c499d242 100644
 --- chrome/browser/ui/BUILD.gn
 +++ chrome/browser/ui/BUILD.gn
 @@ -894,6 +894,7 @@ split_static_library("ui") {

patch/patches/rwh_background_color_1984.patch

@@ -1,5 +1,5 @@
 diff --git content/browser/renderer_host/render_widget_host_view_aura.cc content/browser/renderer_host/render_widget_host_view_aura.cc
-index aefe11960955..7d5cdbead3f8 100644
+index 861122e99087..fc464f5244b7 100644
 --- content/browser/renderer_host/render_widget_host_view_aura.cc
 +++ content/browser/renderer_host/render_widget_host_view_aura.cc
 @@ -726,10 +726,12 @@ gfx::Rect RenderWidgetHostViewAura::GetViewBounds() const {
@@ -19,7 +19,7 @@ index aefe11960955..7d5cdbead3f8 100644
  }
  
  void RenderWidgetHostViewAura::WindowTitleChanged() {
-@@ -1924,6 +1926,15 @@ void RenderWidgetHostViewAura::CreateAuraWindow(aura::client::WindowType type) {
+@@ -1925,6 +1927,15 @@ void RenderWidgetHostViewAura::CreateAuraWindow(aura::client::WindowType type) {
    if (frame_sink_id_.is_valid())
      window_->SetEmbedFrameSinkId(frame_sink_id_);
  

patch/patches/storage_partition_1973.patch

@@ -276,10 +276,10 @@ index 6a6e31bdb070..dce0433e1775 100644
          partition->GetPaymentAppContext();
  
 diff --git content/browser/payments/payment_app_provider_impl.cc content/browser/payments/payment_app_provider_impl.cc
-index dd0af046aec4..f5ad5b37c1f3 100644
+index db44e03f061a..fbba4710aca3 100644
 --- content/browser/payments/payment_app_provider_impl.cc
 +++ content/browser/payments/payment_app_provider_impl.cc
-@@ -371,10 +371,11 @@ void StartServiceWorkerForDispatch(BrowserContext* browser_context,
+@@ -372,10 +372,11 @@ void StartServiceWorkerForDispatch(BrowserContext* browser_context,
                                     ServiceWorkerStartCallback callback) {
    DCHECK_CURRENTLY_ON(BrowserThread::UI);
  
@@ -294,7 +294,7 @@ index dd0af046aec4..f5ad5b37c1f3 100644
  
    BrowserThread::PostTask(
        BrowserThread::IO, FROM_HERE,
-@@ -451,8 +452,8 @@ void PaymentAppProviderImpl::GetAllPaymentApps(
+@@ -452,8 +453,8 @@ void PaymentAppProviderImpl::GetAllPaymentApps(
      GetAllPaymentAppsCallback callback) {
    DCHECK_CURRENTLY_ON(BrowserThread::UI);
  
@@ -306,10 +306,10 @@ index dd0af046aec4..f5ad5b37c1f3 100644
        partition->GetPaymentAppContext();
  
 diff --git content/browser/renderer_host/render_process_host_impl.cc content/browser/renderer_host/render_process_host_impl.cc
-index deece35f627d..2c29eaf50bc9 100644
+index 5ccfa4398c71..0d5e22d341ab 100644
 --- content/browser/renderer_host/render_process_host_impl.cc
 +++ content/browser/renderer_host/render_process_host_impl.cc
-@@ -721,11 +721,10 @@ class DefaultSubframeProcessHostHolder : public base::SupportsUserData::Data,
+@@ -727,11 +727,10 @@ class DefaultSubframeProcessHostHolder : public base::SupportsUserData::Data,
    // Gets the correct render process to use for this SiteInstance.
    RenderProcessHost* GetProcessHost(SiteInstance* site_instance,
                                      bool is_for_guests_only) {
@@ -325,7 +325,7 @@ index deece35f627d..2c29eaf50bc9 100644
  
      // Is this the default storage partition? If it isn't, then just give it its
      // own non-shared process.
-@@ -1332,7 +1331,7 @@ int RenderProcessHost::GetCurrentRenderProcessCountForTesting() {
+@@ -1338,7 +1337,7 @@ int RenderProcessHost::GetCurrentRenderProcessCountForTesting() {
  // static
  RenderProcessHost* RenderProcessHostImpl::CreateRenderProcessHost(
      BrowserContext* browser_context,
@@ -334,7 +334,7 @@ index deece35f627d..2c29eaf50bc9 100644
      SiteInstance* site_instance,
      bool is_for_guests_only) {
    if (g_render_process_host_factory_) {
-@@ -1341,8 +1340,8 @@ RenderProcessHost* RenderProcessHostImpl::CreateRenderProcessHost(
+@@ -1347,8 +1346,8 @@ RenderProcessHost* RenderProcessHostImpl::CreateRenderProcessHost(
    }
  
    if (!storage_partition_impl) {
@@ -345,7 +345,7 @@ index deece35f627d..2c29eaf50bc9 100644
    }
    // If we've made a StoragePartition for guests (e.g., for the <webview> tag),
    // stash the Site URL on it. This way, when we start a service worker inside
-@@ -1367,7 +1366,7 @@ const unsigned int RenderProcessHostImpl::kMaxFrameDepthForPriority =
+@@ -1373,7 +1372,7 @@ const unsigned int RenderProcessHostImpl::kMaxFrameDepthForPriority =
  
  RenderProcessHostImpl::RenderProcessHostImpl(
      BrowserContext* browser_context,
@@ -354,7 +354,7 @@ index deece35f627d..2c29eaf50bc9 100644
      bool is_for_guests_only)
      : fast_shutdown_started_(false),
        deleting_soon_(false),
-@@ -1400,7 +1399,8 @@ RenderProcessHostImpl::RenderProcessHostImpl(
+@@ -1406,7 +1405,8 @@ RenderProcessHostImpl::RenderProcessHostImpl(
        indexed_db_factory_(new IndexedDBDispatcherHost(
            id_,
            storage_partition_impl_->GetURLRequestContext(),
@@ -364,7 +364,7 @@ index deece35f627d..2c29eaf50bc9 100644
            ChromeBlobStorageContext::GetFor(browser_context_))),
        channel_connected_(false),
        sent_render_process_ready_(false),
-@@ -1435,7 +1435,8 @@ RenderProcessHostImpl::RenderProcessHostImpl(
+@@ -1441,7 +1441,8 @@ RenderProcessHostImpl::RenderProcessHostImpl(
    }
  
    push_messaging_manager_.reset(new PushMessagingManager(
@@ -374,7 +374,7 @@ index deece35f627d..2c29eaf50bc9 100644
  
    AddObserver(indexed_db_factory_.get());
  #if defined(OS_MACOSX)
-@@ -1768,6 +1769,17 @@ void RenderProcessHostImpl::ResetChannelProxy() {
+@@ -1774,6 +1775,17 @@ void RenderProcessHostImpl::ResetChannelProxy() {
  
  void RenderProcessHostImpl::CreateMessageFilters() {
    DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ -392,7 +392,7 @@ index deece35f627d..2c29eaf50bc9 100644
    AddFilter(new ResourceSchedulerFilter(GetID()));
    MediaInternals* media_internals = MediaInternals::GetInstance();
    // Add BrowserPluginMessageFilter to ensure it gets the first stab at messages
-@@ -1781,8 +1793,8 @@ void RenderProcessHostImpl::CreateMessageFilters() {
+@@ -1787,8 +1799,8 @@ void RenderProcessHostImpl::CreateMessageFilters() {
        new RenderMessageFilter(
            GetID(), GetBrowserContext(), request_context.get(),
            widget_helper_.get(), media_internals,
@@ -403,7 +403,7 @@ index deece35f627d..2c29eaf50bc9 100644
    AddFilter(render_message_filter.get());
  
    render_frame_message_filter_ = new RenderFrameMessageFilter(
-@@ -1809,10 +1821,10 @@ void RenderProcessHostImpl::CreateMessageFilters() {
+@@ -1815,10 +1827,10 @@ void RenderProcessHostImpl::CreateMessageFilters() {
        ChromeBlobStorageContext::GetFor(browser_context);
  
    resource_message_filter_ = new ResourceMessageFilter(
@@ -416,7 +416,7 @@ index deece35f627d..2c29eaf50bc9 100644
        storage_partition_impl_->GetPrefetchURLLoaderService(),
        std::move(get_contexts_callback),
        BrowserThread::GetTaskRunnerForThread(BrowserThread::IO));
-@@ -1821,8 +1833,7 @@ void RenderProcessHostImpl::CreateMessageFilters() {
+@@ -1827,8 +1839,7 @@ void RenderProcessHostImpl::CreateMessageFilters() {
  
    AddFilter(
        new MidiHost(GetID(), BrowserMainLoop::GetInstance()->midi_service()));
@@ -426,7 +426,7 @@ index deece35f627d..2c29eaf50bc9 100644
  
    peer_connection_tracker_host_ = new PeerConnectionTrackerHost(GetID());
    AddFilter(peer_connection_tracker_host_.get());
-@@ -1840,8 +1851,7 @@ void RenderProcessHostImpl::CreateMessageFilters() {
+@@ -1846,8 +1857,7 @@ void RenderProcessHostImpl::CreateMessageFilters() {
  
    auto service_worker_filter =
        base::MakeRefCounted<ServiceWorkerDispatcherHost>(GetID());
@@ -436,7 +436,7 @@ index deece35f627d..2c29eaf50bc9 100644
    AddFilter(service_worker_filter.get());
  
    p2p_socket_dispatcher_host_ = new P2PSocketDispatcherHost(
-@@ -1850,10 +1860,6 @@ void RenderProcessHostImpl::CreateMessageFilters() {
+@@ -1856,10 +1866,6 @@ void RenderProcessHostImpl::CreateMessageFilters() {
  
    AddFilter(new TraceMessageFilter(GetID()));
    AddFilter(new ResolveProxyMsgHelper(request_context.get()));
@@ -447,7 +447,7 @@ index deece35f627d..2c29eaf50bc9 100644
  }
  
  void RenderProcessHostImpl::BindCacheStorage(
-@@ -1865,7 +1871,8 @@ void RenderProcessHostImpl::BindCacheStorage(
+@@ -1871,7 +1877,8 @@ void RenderProcessHostImpl::BindCacheStorage(
      cache_storage_dispatcher_host_ =
          base::MakeRefCounted<CacheStorageDispatcherHost>();
      cache_storage_dispatcher_host_->Init(
@@ -457,7 +457,7 @@ index deece35f627d..2c29eaf50bc9 100644
    }
    // Send the binding to IO thread, because Cache Storage handles Mojo IPC on IO
    // thread entirely.
-@@ -1996,7 +2003,8 @@ void RenderProcessHostImpl::RegisterMojoInterfaces() {
+@@ -2023,7 +2030,8 @@ void RenderProcessHostImpl::RegisterMojoInterfaces() {
  
    registry->AddInterface(base::BindRepeating(
        &AppCacheDispatcherHost::Create,
@@ -468,7 +468,7 @@ index deece35f627d..2c29eaf50bc9 100644
  
    AddUIThreadInterface(registry.get(), base::Bind(&FieldTrialRecorder::Create));
 diff --git content/browser/renderer_host/render_process_host_impl.h content/browser/renderer_host/render_process_host_impl.h
-index 60a1958f3ca9..922e2100f7c9 100644
+index b418b4c8a0ad..30817ff2e0fd 100644
 --- content/browser/renderer_host/render_process_host_impl.h
 +++ content/browser/renderer_host/render_process_host_impl.h
 @@ -89,7 +89,6 @@ class ResourceMessageFilter;
@@ -488,7 +488,7 @@ index 60a1958f3ca9..922e2100f7c9 100644
        SiteInstance* site_instance,
        bool is_for_guests_only);
  
-@@ -435,7 +434,7 @@ class CONTENT_EXPORT RenderProcessHostImpl
+@@ -438,7 +437,7 @@ class CONTENT_EXPORT RenderProcessHostImpl
    // Use CreateRenderProcessHost() instead of calling this constructor
    // directly.
    RenderProcessHostImpl(BrowserContext* browser_context,
@@ -497,7 +497,7 @@ index 60a1958f3ca9..922e2100f7c9 100644
                          bool is_for_guests_only);
  
    // Initializes a new IPC::ChannelProxy in |channel_|, which will be connected
-@@ -700,10 +699,10 @@ class CONTENT_EXPORT RenderProcessHostImpl
+@@ -707,10 +706,10 @@ class CONTENT_EXPORT RenderProcessHostImpl
    // called.
    int instance_id_ = 1;
  

patch/patches/views_widget_180_1481_1565_1677_1749.patch

@@ -1,5 +1,5 @@
 diff --git content/browser/renderer_host/render_widget_host_view_base.cc content/browser/renderer_host/render_widget_host_view_base.cc
-index d52e0e45d4e1..4cc91095d9c9 100644
+index 1c52a5fd396f..96cd3a6230e9 100644
 --- content/browser/renderer_host/render_widget_host_view_base.cc
 +++ content/browser/renderer_host/render_widget_host_view_base.cc
 @@ -422,6 +422,14 @@ float RenderWidgetHostViewBase::GetDeviceScaleFactor() const {
@@ -18,7 +18,7 @@ index d52e0e45d4e1..4cc91095d9c9 100644
    return renderer_frame_number_;
  }
 diff --git content/browser/renderer_host/render_widget_host_view_base.h content/browser/renderer_host/render_widget_host_view_base.h
-index be17cb811c58..d06168e39008 100644
+index 048fd7d3a8bf..b0f5ea8a085c 100644
 --- content/browser/renderer_host/render_widget_host_view_base.h
 +++ content/browser/renderer_host/render_widget_host_view_base.h
 @@ -84,6 +84,7 @@ class CursorManager;

patch/patches/web_contents_1257_1565.patch

@@ -1,8 +1,8 @@
 diff --git content/browser/web_contents/web_contents_impl.cc content/browser/web_contents/web_contents_impl.cc
-index dde4f26a40c3..9249b0cbb6a1 100644
+index 6ae9bf2f9c6a..a4b929545e3e 100644
 --- content/browser/web_contents/web_contents_impl.cc
 +++ content/browser/web_contents/web_contents_impl.cc
-@@ -1797,21 +1797,30 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params) {
+@@ -1845,21 +1845,30 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params) {
    std::string unique_name;
    frame_tree_.root()->SetFrameName(params.main_frame_name, unique_name);
  
@@ -45,7 +45,7 @@ index dde4f26a40c3..9249b0cbb6a1 100644
    CHECK(render_view_host_delegate_view_);
    CHECK(view_.get());
  
-@@ -2418,6 +2427,15 @@ void WebContentsImpl::CreateNewWindow(
+@@ -2467,6 +2476,15 @@ void WebContentsImpl::CreateNewWindow(
    create_params.renderer_initiated_creation =
        main_frame_route_id != MSG_ROUTING_NONE;
  
@@ -61,7 +61,7 @@ index dde4f26a40c3..9249b0cbb6a1 100644
    std::unique_ptr<WebContents> new_contents;
    if (!is_guest) {
      create_params.context = view_->GetNativeView();
-@@ -2448,7 +2466,7 @@ void WebContentsImpl::CreateNewWindow(
+@@ -2497,7 +2515,7 @@ void WebContentsImpl::CreateNewWindow(
        // TODO(brettw): It seems bogus that we have to call this function on the
        // newly created object and give it one of its own member variables.
        new_view->CreateViewForWidget(
@@ -70,7 +70,7 @@ index dde4f26a40c3..9249b0cbb6a1 100644
      }
      // Save the created window associated with the route so we can show it
      // later.
-@@ -5742,7 +5760,7 @@ InterstitialPageImpl* WebContentsImpl::GetInterstitialForRenderManager() {
+@@ -5791,7 +5809,7 @@ InterstitialPageImpl* WebContentsImpl::GetInterstitialForRenderManager() {
  void WebContentsImpl::CreateRenderWidgetHostViewForRenderManager(
      RenderViewHost* render_view_host) {
    RenderWidgetHostViewBase* rwh_view =
@@ -80,13 +80,13 @@ index dde4f26a40c3..9249b0cbb6a1 100644
    // Now that the RenderView has been created, we need to tell it its size.
    if (rwh_view)
 diff --git content/public/browser/web_contents.cc content/public/browser/web_contents.cc
-index 53d56abb35a3..d7b955f42ca5 100644
+index df508da0aef2..f6f4bf42b108 100644
 --- content/public/browser/web_contents.cc
 +++ content/public/browser/web_contents.cc
 @@ -30,7 +30,9 @@ WebContents::CreateParams::CreateParams(BrowserContext* context,
        context(nullptr),
        renderer_initiated_creation(false),
-       initialize_renderer(false),
+       desired_renderer_state(kOkayToHaveRendererProcess),
 -      starting_sandbox_flags(blink::WebSandboxFlags::kNone) {}
 +      starting_sandbox_flags(blink::WebSandboxFlags::kNone),
 +      view(nullptr),
@@ -95,7 +95,7 @@ index 53d56abb35a3..d7b955f42ca5 100644
  WebContents::CreateParams::CreateParams(const CreateParams& other) = default;
  
 diff --git content/public/browser/web_contents.h content/public/browser/web_contents.h
-index c4a7f3173b98..d42beefe4589 100644
+index dee5814a247c..c9e57ef5680b 100644
 --- content/public/browser/web_contents.h
 +++ content/public/browser/web_contents.h
 @@ -74,9 +74,11 @@ class BrowserPluginGuestDelegate;
@@ -110,7 +110,7 @@ index c4a7f3173b98..d42beefe4589 100644
  struct CustomContextMenuContext;
  struct DropData;
  struct MHTMLGenerationParams;
-@@ -178,6 +180,10 @@ class WebContents : public PageNavigator,
+@@ -215,6 +217,10 @@ class WebContents : public PageNavigator,
  
      // Sandboxing flags set on the new WebContents.
      blink::WebSandboxFlags starting_sandbox_flags;

patch/patches/webkit_plugin_info_2015.patch

@@ -62,10 +62,10 @@ index f98ae01cd46d..bba0b1930bff 100644
  
  void WebDevToolsAgentImpl::Session::SendProtocolResponse(int session_id,
 diff --git third_party/blink/renderer/core/frame/local_frame.cc third_party/blink/renderer/core/frame/local_frame.cc
-index f0c55c05da71..9f0ede2594e4 100644
+index 5686e6a06d6f..9e65585bdb0b 100644
 --- third_party/blink/renderer/core/frame/local_frame.cc
 +++ third_party/blink/renderer/core/frame/local_frame.cc
-@@ -1228,7 +1228,7 @@ FrameResourceCoordinator* LocalFrame::GetFrameResourceCoordinator() {
+@@ -1241,7 +1241,7 @@ FrameResourceCoordinator* LocalFrame::GetFrameResourceCoordinator() {
  PluginData* LocalFrame::GetPluginData() const {
    if (!Loader().AllowPlugins(kNotAboutToInstantiatePlugin))
      return nullptr;

patch/patches/webkit_rtl_scrollbars_250514.patch

@@ -0,0 +1,86 @@
+diff --git third_party/blink/renderer/core/layout/layout_box.cc third_party/blink/renderer/core/layout/layout_box.cc
+index d56be3429c19..c87209743c34 100644
+--- third_party/blink/renderer/core/layout/layout_box.cc
++++ third_party/blink/renderer/core/layout/layout_box.cc
+@@ -4402,6 +4402,7 @@ void LayoutBox::ComputePositionedLogicalWidthUsing(
+   }
+ 
+   if (container_block->IsBox() &&
++      container_block->IsHorizontalWritingMode() == IsHorizontalWritingMode() &&
+       ToLayoutBox(container_block)->ScrollsOverflowY() &&
+       ToLayoutBox(container_block)
+           ->ShouldPlaceBlockDirectionScrollbarOnLogicalLeft()) {
+@@ -4758,6 +4759,15 @@ void LayoutBox::ComputePositionedLogicalHeightUsing(
+   }
+   computed_values.extent_ = logical_height_value;
+ 
++  if (container_block->IsBox() &&
++      container_block->IsHorizontalWritingMode() != IsHorizontalWritingMode() &&
++      ToLayoutBox(container_block)->ScrollsOverflowY() &&
++      ToLayoutBox(container_block)
++          ->ShouldPlaceBlockDirectionScrollbarOnLogicalLeft()) {
++    logical_top_value = logical_top_value +
++                         ToLayoutBox(container_block)->VerticalScrollbarWidth();
++  }
++
+   // Use computed values to calculate the vertical position.
+   computed_values.position_ =
+       logical_top_value + computed_values.margins_.before_;
+diff --git third_party/blink/renderer/core/layout/layout_view.cc third_party/blink/renderer/core/layout/layout_view.cc
+index bc3bf00be630..82a6e77878ef 100644
+--- third_party/blink/renderer/core/layout/layout_view.cc
++++ third_party/blink/renderer/core/layout/layout_view.cc
+@@ -253,6 +253,22 @@ void LayoutView::SetShouldDoFullPaintInvalidationOnResizeIfNeeded(
+   }
+ }
+ 
++bool LayoutView::ShouldPlaceBlockDirectionScrollbarOnLogicalLeft() const {
++  LocalFrame& frame = GetFrameView()->GetFrame();
++  // See crbug.com/249860
++  if (frame.IsMainFrame())
++    return false;
++  // <body> inherits 'direction' from <html>, so checking style on the body is
++  // sufficient.
++  if (Element* body = GetDocument().body()) {
++    if (LayoutObject* body_layout_object = body->GetLayoutObject()) {
++      return body_layout_object->Style()
++          ->ShouldPlaceBlockDirectionScrollbarOnLogicalLeft();
++    }
++  }
++  return false;
++}
++
+ void LayoutView::UpdateBlockLayout(bool relayout_children) {
+   SubtreeLayoutScope layout_scope(*this);
+ 
+diff --git third_party/blink/renderer/core/layout/layout_view.h third_party/blink/renderer/core/layout/layout_view.h
+index 867d64060c1e..e0f87a8d555f 100644
+--- third_party/blink/renderer/core/layout/layout_view.h
++++ third_party/blink/renderer/core/layout/layout_view.h
+@@ -230,13 +230,7 @@ class CORE_EXPORT LayoutView final : public LayoutBlockFlow {
+   void SetShouldDoFullPaintInvalidationOnResizeIfNeeded(bool width_changed,
+                                                         bool height_changed);
+ 
+-  // The document scrollbar is always on the right, even in RTL. This is to
+-  // prevent it from moving around on navigations.
+-  // TODO(skobes): This is not quite the ideal behavior, see
+-  // http://crbug.com/250514 and http://crbug.com/249860.
+-  bool ShouldPlaceBlockDirectionScrollbarOnLogicalLeft() const override {
+-    return false;
+-  }
++  bool ShouldPlaceBlockDirectionScrollbarOnLogicalLeft() const override;
+ 
+   LayoutRect DebugRect() const override;
+ 
+diff --git third_party/blink/renderer/core/paint/compositing/composited_layer_mapping.cc third_party/blink/renderer/core/paint/compositing/composited_layer_mapping.cc
+index 32861ebbc2cc..0bee41ae2cb2 100644
+--- third_party/blink/renderer/core/paint/compositing/composited_layer_mapping.cc
++++ third_party/blink/renderer/core/paint/compositing/composited_layer_mapping.cc
+@@ -1313,6 +1313,7 @@ void CompositedLayerMapping::ComputeGraphicsLayerParentLocation(
+     IntSize scroll_offset = layout_box.ScrolledContentOffset();
+     IntPoint scroll_origin =
+         compositing_container->GetScrollableArea()->ScrollOrigin();
++    scroll_origin.Move(-layout_box.OriginAdjustmentForScrollbars());
+     scroll_origin.Move(-layout_box.BorderLeft().ToInt(),
+                        -layout_box.BorderTop().ToInt());
+     graphics_layer_parent_location = -(scroll_origin + scroll_offset);

patch/patches/webview_plugin_2020.patch

@@ -1,5 +1,5 @@
 diff --git chrome/app/generated_resources.grd chrome/app/generated_resources.grd
-index d1d9d62e4af3..e673f8763006 100644
+index c0d79d06693d..a9787e1aa020 100644
 --- chrome/app/generated_resources.grd
 +++ chrome/app/generated_resources.grd
 @@ -4602,7 +4602,7 @@ Keep your key file in a safe place. You will need it to create new versions of y

tests/cefclient/resources/mac/Info.plist

@@ -22,6 +22,11 @@
 	<string>????</string>
 	<key>CFBundleVersion</key>
 	<string>1.0</string>
+	<key>LSEnvironment</key>
+	<dict>
+		<key>MallocNanoZone</key>
+		<string>0</string>
+	</dict>
 	<key>LSMinimumSystemVersion</key>
 	<string>10.9.0</string>
 	<key>NSMainNibFile</key>

tests/cefclient/resources/mac/helper-Info.plist

@@ -20,6 +20,11 @@
 	<string>1.0</string>
 	<key>CFBundleSignature</key>
 	<string>????</string>
+	<key>LSEnvironment</key>
+	<dict>
+		<key>MallocNanoZone</key>
+		<string>0</string>
+	</dict>
 	<key>LSFileQuarantineEnabled</key>
 	<true/>
 	<key>LSMinimumSystemVersion</key>

tests/cefsimple/mac/Info.plist

@@ -20,6 +20,11 @@
 	<string>????</string>
 	<key>CFBundleVersion</key>
 	<string>1.0</string>
+	<key>LSEnvironment</key>
+	<dict>
+		<key>MallocNanoZone</key>
+		<string>0</string>
+	</dict>
 	<key>LSMinimumSystemVersion</key>
 	<string>10.9.0</string>
 	<key>NSMainNibFile</key>

tests/cefsimple/mac/helper-Info.plist

@@ -18,6 +18,11 @@
 	<string>APPL</string>
 	<key>CFBundleSignature</key>
 	<string>????</string>
+	<key>LSEnvironment</key>
+	<dict>
+		<key>MallocNanoZone</key>
+		<string>0</string>
+	</dict>
 	<key>LSFileQuarantineEnabled</key>
 	<true/>
 	<key>LSMinimumSystemVersion</key>

tests/ceftests/resources/mac/Info.plist

@@ -20,6 +20,11 @@
 	<string>????</string>
 	<key>CFBundleVersion</key>
 	<string>1.0</string>
+	<key>LSEnvironment</key>
+	<dict>
+		<key>MallocNanoZone</key>
+		<string>0</string>
+	</dict>
 	<key>NSMainNibFile</key>
 	<string>MainMenu</string>
 	<key>NSPrincipalClass</key>

tests/ceftests/resources/mac/helper-Info.plist

@@ -18,6 +18,11 @@
 	<string>APPL</string>
 	<key>CFBundleSignature</key>
 	<string>????</string>
+	<key>LSEnvironment</key>
+	<dict>
+		<key>MallocNanoZone</key>
+		<string>0</string>
+	</dict>
 	<key>LSFileQuarantineEnabled</key>
 	<true/>
 	<key>LSMinimumSystemVersion</key>

tools/distrib/mac/README.redistrib.txt

@@ -20,7 +20,6 @@ cefclient.app/
           cef_200_percent.pak <====^
           cef_extensions.pak <=====^
           devtools_resources.pak <=^
-          crash_inspector, crash_report_sender <= breakpad support
           icudtl.dat <= unicode support
           natives_blob.bin, snapshot_blob.bin, v8_context_snapshot.bin <= V8 initial snapshot
           en.lproj/, ... <= locale-specific resources and strings
@@ -98,9 +97,3 @@ run but any related functionality may become broken or disabled.
   * Chromium Embedded Framework.framework/Resources/devtools_resources.pak
     This file contains non-localized resources required for Chrome Developer
     Tools. Without this file Chrome Developer Tools will not function.
-
-* Breakpad support.
-  * Chromium Embedded Framework.framework/Resources/crash_inspector
-  * Chromium Embedded Framework.framework/Resources/crash_report_sender
-  * Chromium Embedded Framework.framework/Resources/Info.plist
-    Without these files breakpad support (crash reporting) will not function.

tools/gn_args.py

@@ -251,6 +251,10 @@ def GetRequiredArgs():
 
       # Don't use the chrome style plugin.
       'clang_use_chrome_plugins': False,
+
+      # Disable cfi-icall which is not supported by the CEF bindings layer (see
+      # issue #2472).
+      'use_cfi_icall': False,
   }
 
   if platform == 'linux':